Senior Product Security Engineer

About the role

Medtronic Cranial, Spine and Therapy (CST) is looking for a Senior Product Security Engineer to join its R&D organization and help secure medical device and cloud-based solutions across the Aible ecosystem. The role focuses on product cybersecurity for medical devices, connected platforms and cloud applications, with related governance, risk and compliance responsibilities that support regulatory requirements. It is not a traditional IT security or dedicated GRC role. The position is based in Caesarea, Israel, on a hybrid basis with at least two days per week onsite.

Key responsibilities

• Partner with engineering teams to embed cybersecurity requirements throughout the product development lifecycle, from design through post-market support.
• Conduct threat modeling, security risk assessments and vulnerability analyses across medical devices, cloud applications and connected ecosystems.
• Support the design and implementation of security controls such as secure boot, encryption, secure communications, software update mechanisms and access controls.
• Apply cybersecurity standards, frameworks and secure development practices to strengthen product security.
• Evaluate security findings, recommend mitigations and support remediation with development teams.
• Collaborate with software, systems, cloud, quality, regulatory and product teams to achieve secure-by-design outcomes.
• Support product cybersecurity governance, risk and compliance activities and give technical guidance on emerging threats and best practices.

Required profile

• Bachelor's degree with 7+ years, or master's degree with 5+ years, of experience in product security, application security, cybersecurity engineering or related roles.
• Experience securing cloud applications in a regulated industry environment.
• Experience conducting threat modeling, security risk assessments and vulnerability analysis.
• Experience partnering with engineering teams to identify and mitigate technical security risks.

Required skills

• Knowledge of cybersecurity frameworks and standards including NIST and OWASP.
• Preferred: experience with secure SDLC and secure-by-design practices.
• Preferred: experience with medical device cybersecurity standards (IEC 62304, ISO 14971) and FDA cybersecurity guidance, and with regulatory cybersecurity submissions.
• Preferred: experience with cloud-connected medical devices and digital health platforms; preferred certifications such as CISSP, CompTIA Security+, CSSLP.

What we offer

• A competitive salary and a flexible benefits package.
• Eligibility for the Medtronic Incentive Plan (MIP).